Surface
Quantum-capable cryptanalysis is not required for post-quantum work to be urgent. Harvest-now-decrypt-later collectors only need cheap storage and patience. If your ciphertext must stay confidential into the 2030s, waiting for a dramatic headline is how you inherit an emergency program.
In August 2024, NIST finalized the first PQC standards: FIPS 203 ML-KEM, FIPS 204 ML-DSA, and FIPS 205 SLH-DSA. NIST IR 8547 outlines a deprecation trajectory toward 2035. “Migrate now” does not mean flip every production cipher tomorrow. It means build crypto-agility, start dual-stack where risk is highest, and stop shipping systems that assume RSA/ECC forever.
Prioritize by data lifetime, not by hype
Use your threat model to sort systems:
1. Long-lived confidentiality — KYC packs, custody statements, encrypted backups, VPN/archive captures of sensitive traffic 2. Authentication & integrity with long verification windows — firmware signatures, root certificates, document signing 3. Short-lived sessions — many TLS connections where confidentiality needs are brief (still plan agility; urgency is lower than archives)
Financial breach costs remain material in IBM’s Cost of a Data Breach series ($4.88M global average in 2024; about $4.44M in 2025). PQC programs are cheaper when they are phased engineering than when they collide with a forced partner cutover.
A dual-stack playbook that respects production
Post-quantum migration waves
- W0
Inventory
Catalog algorithms, owners, lifetimes
- W1
Hybrid KEM
Long-lived channels + key wrap
- W2
Dual-verify
Signatures on high-value artifacts
- W3
Re-wrap
Archives by retention class
- W4
Deprecate
Classical allowlists retire on dates
Insight: dual-stack now beats a cliff-edge cutover when IR 8547 timelines harden toward 2035.
Inventory and classify
List protocols, libraries, HSMs, MPC stacks, mobile apps, and partner APIs. Tag each with algorithm, owner, and confidentiality lifetime. Anything you cannot find will not migrate on schedule—and will surprise you during an audit.
Prefer hybrid KEMs for transport and wrapping first
Hybrid designs combine a classical key exchange with ML-KEM so breaking one algorithm alone does not expose the session or wrapped key. This buys protection against harvest-now-decrypt-later while peers catch up. Size and performance costs are real; measure them on your critical paths instead of arguing in the abstract.
Dual-verify signatures during transition
For ML-DSA or SLH-DSA migrations, verify classical and PQC signatures while both are present, then retire the classical requirement on a published date. Message formats need algorithm IDs—another reason key and protocol layers must stay agile. Custody stacks from the HSM / MPC essay need vendor roadmaps in writing.
Re-wrap archives on a retention schedule
Do not assume yesterday’s RSA-wrapped DEKs are fine until 2035. Plan re-encrypt / re-wrap waves by retention class. That work is tedious and high leverage.
| Wave | Scope | Primary PQC move | Success metric |
|---|---|---|---|
| 0 | Inventory + crypto-agility hooks | Algorithm IDs, dual-run APIs | 100% critical flows catalogued |
| 1 | External TLS / VPN / key wrap for long-lived data | Hybrid KEM (classical + ML-KEM) | Hybrid default on priority channels |
| 2 | Code signing, document, and governance signatures | Dual-verify ML-DSA / SLH-DSA | Dual signatures on new high-value artifacts |
| 3 | Archives & backups | Re-wrap under hybrid/PQC policy | % of sensitive archives re-wrapped |
| 4 | Deprecate classical where IR 8547 / policy require | PQC-only allowlists | Classical disabled on target dates |
Governance, partners, and MiCA-era expectations
If you operate with or as a crypto-asset service provider under EU MiCA, operational resilience and custody narratives increasingly assume you can explain cryptographic change management. PQC is becoming part of that story. Even outside MiCA, enterprise partners will send questionnaires asking about quantum readiness; empty answers become sales friction.
Keep AI and automation off the critical path for key ceremonies and cutovers. Probabilistic systems can assist with inventory analysis; they should not silently approve migrations—see AI and on-chain data boundaries.
What “done enough” looks like in 2026
- Critical flows are inventoried with owners
- Crypto interfaces accept new algorithm IDs without app rewrites
- Hybrid KEM is live or scheduled on the highest-lifetime channels
- Signature dual-verify is designed for governance and release signing
- Archive re-wrap has a funded calendar
- Vendors (HSM, MPC, CDN, KMS) have documented PQC roadmaps reviewed by security and engineering
Migration is a program, not a ticket. Next we treat compliance as crypto architecture—how regulatory obligations should shape these waves instead of arriving as a surprise spreadsheet.
